PT-2021-14381 · Synapse+1 · Synapse+1

Clokep · Published 2021-02-24 · Updated 2022-10-24 · CVE-2021-21274

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.25.0

Description: A malicious homeserver could redirect requests to their .well-known file to a large file, leading to a denial of service attack where homeservers consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server that accepts federation requests from untrusted servers.

Recommendations: For Synapse versions prior to 1.25.0, update to version 1.25.0 to resolve the issue. As a temporary workaround, consider using the federation domain whitelist setting to restrict the homeservers communicated with over federation.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2021-1385

CVE-2021-21274

GHSA-2HWX-MJRM-V3G8

PYSEC-2021-132

Affected Products

Alt Linux

Synapse

References · 19

• https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6 · Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8 · Patch
• https://github.com/matrix-org/synapse/pull/8950 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21274 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-21274 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-132 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21274 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hwx-mjrm-v3g8 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21274 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21274 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21274 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21274 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.25.0 · Note